Trust and transparency
The Flarely runner
Flarely runs Playwright checks that our customers write against their own sites, on a schedule and on every deploy. This page is for anyone who needs to identify, allow or verify that traffic. Last updated .
Quick facts
- Identity
- Web Bot Auth (RFC 9421 HTTP Message Signatures),
Signature-Agent: "https://flarely.app" - Key directory
https://flarely.app/.well-known/http-message-signatures-directory- Browser
- Chromium, driven by Playwright, from Cloudflare's network. The User-Agent is Chromium's own unless the customer's test sets one.
- What it fetches
- Only the URLs the customer's check visits, at the cadence they set: typically one page flow every one to fifteen minutes, or once per deploy.
- Contact
- hello@flarely.app
Allowing us
In Cloudflare, add flarely.app under Security, Bots, Signed agents; requests are then verified against our directory on every hop. Elsewhere, match the signature-agent header, or verify the signature with Cloudflare's open source web-bot-auth library. Details and copyable rules are in signed traffic and evidence bundles.
Blocking us
Checks only ever target sites our customers point them at, so if you are seeing our traffic and did not ask for it, someone with access to your site set up a check. Email us with the host and we will stop it and tell the account owner. We do not crawl, discover or index anything.
Verifying a signature
Signatures cover the host they are sent to and expire after a minute. Fetch the directory, find the key whose RFC 8037 thumbprint matches the signature's keyid, and verify with any RFC 9421 implementation. A worked example is in the docs.